wiki-plugin-stage

A Federated Wiki plugin that presents an HTML asset or inline standalone HTML fullscreen — slides, dashboards, visualisations — from a relative /assets path, an absolute URL, or HTML pasted into the item itself, which travels with the fork.

Item syntax

UPPERCASE directives first, one per line, then the body:

ASSET deck.html          serve from the page's own /assets folder
HTML  https://…          or an absolute URL
IMPORT https://…         fetch once and inline the HTML into the item
POSTER cover.png         click-to-load poster image
RATIO 4/3                aspect ratio (default 16/9)
TITLE My Deck            caption in the bar

<h1>…or paste standalone HTML here…</h1>

Trust model

• Inline/embedded HTML is sanitised with DOMPurify and rendered in an iframe with sandbox="" — no scripts, ever.
• Referenced assets run with sandbox="allow-scripts allow-popups allow-popups-to-escape-sandbox" and no allow-same-origin, so they cannot read the wiki's cookies or storage. Note the deliberate tradeoff: a hostile referenced asset can open an unsandboxed popup.
• An un-sandboxed TRUST mode is intentionally not implemented, pending identity and code signing.

Install

npm install wiki-plugin-stage

Restart the wiki server so the factory and the bundled about page register.

Develop

npm install
npm run build   # esbuild bundle into client/
npm test        # node --test over the pure parse/build helpers

License

MIT © David Bovill